# IP Range Aggregation(IP范圍聚合) 原文鏈接 : [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-iprange-aggregation.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-iprange-aggregation.html) 譯文鏈接 : [IP Range Aggregation(IP范圍聚合)](http://apache.wiki/pages/viewpage.action?pageId=10028841&src=contextnavpagetreemode) 貢獻者 : @于永超，[ApacheCN](/display/~apachecn)，[Apache中文網](/display/~apachechina) ## IP Range Aggregation 就像專用的[日期](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-daterange-aggregation.html)范圍聚合一樣，IP類型字段也有專用的范圍聚合: 例子： ``` { "aggs" : { "ip_ranges" : { "ip_range" : { "field" : "ip", "ranges" : [ { "to" : "10.0.0.5" }, { "from" : "10.0.0.5" } ] } } } } ``` 響應結果： ``` { ... "aggregations": { "ip_ranges": { "buckets" : [ { "to": "10.0.0.5", "doc_count": 4 }, { "from": "10.0.0.5", "doc_count": 6 } ] } } } ``` IP范圍也可以定義為CIDR掩碼 ``` { "aggs" : { "ip_ranges" : { "ip_range" : { "field" : "ip", "ranges" : [ { "mask" : "10.0.0.0/25" }, { "mask" : "10.0.0.127/25" } ] } } } } ``` 響應結果： ``` { "aggregations": { "ip_ranges": { "buckets": [ { "key": "10.0.0.0/25", "from": "10.0.0.0", "to": "10.0.0.127", "doc_count": 127 }, { "key": "10.0.0.127/25", "from": "10.0.0.0", "to": "10.0.0.127", "doc_count": 127 } ] } } } ``` ### Keyed Response 將keyed標志設置為true會將一個惟一的字符串鍵與每個bucket關聯起來，并將范圍作為散列而不是數組返回: ``` { "aggs": { "ip_ranges": { "ip_range": { "field": "remote_ip", "ranges": [ { "to" : "10.0.0.5" }, { "from" : "10.0.0.5" } ], "keyed": true } } } } ``` 響應結果： ``` { ... "aggregations": { "ip_ranges": { "buckets": { "*-10.0.0.5": { "to": "10.0.0.5", "doc_count": 1462 }, "10.0.0.5-*": { "from": "10.0.0.5", "doc_count": 50000 } } } } } ``` 可以為每一個范圍自定義key： ``` { "aggs": { "ip_ranges": { "ip_range": { "field": "remote_ip", "ranges": [ { "key": "infinity", "to" : "10.0.0.5" }, { "key": "and-beyond", "from" : "10.0.0.5" } ], "keyed": true } } } } ``` 響應結果： ``` { ... "aggregations": { "ip_ranges": { "buckets": { "infinity": { "to": "10.0.0.5", "doc_count": 1462 }, "and-beyond": { "from": "10.0.0.5", "doc_count": 50000 } } } } } ```